* TCP traffic in ipip tunnel inside wireguard connection
@ 2017-05-29 20:57 Ivan Leonardo
2017-05-29 21:02 ` Jason A. Donenfeld
2017-06-06 20:49 ` Jörg Thalheim
0 siblings, 2 replies; 3+ messages in thread
From: Ivan Leonardo @ 2017-05-29 20:57 UTC (permalink / raw)
To: wireguard
Hello
Recently i have been experimenting with wireguard, and in fact the
performance in wg is better than the ipsec tunnels i have. In my ipsec
implementation i'm using vti interfaces(SAs 0.0.0.0/0) and i can select
the traffic flow with static/dynamic routing.
Knowing that wg doesn't allow multiple tunnels with allowedip=0.0.0.0/0,
i tried to create a ipip tunnel using the wg endpoint tunnel ips. I
don't have problems with UDP/ICMP traffic, but with TCP when a
host(192.168.1.110) in lan1 tries to communicate with the ip of the ipip
tunnel in server2, the returning tcp traffic has bad tcp checksum and
the packets are discarded. If i try to send tcp packets with the source
ip of the ipip tunnel of server2 to host(192.168.1.110) in lan1 , in
tcpdump in server2 i see the tcp packets, but in the tcpdump in server1
i dont see the packets.
Resuming, in this topology i only have problems with tcp traffic, udp
and icmp works fine.
I have search the web for this use case, but didn't find anyone using
it, in this topic
https://forum.freifunk.net/t/wireguard-0-0-20161230-linuxkernel-3-18-gluon-v2016-2-2/14122
, they managed to get a gre/gretap tunnel functioning with wg.
Does anyone have any ideia if its possible to use this topology?
Topology:
172.16.17.2/30 172.16.17.1/30
wg0(172.16.17.0/30)
Server2 <----------------------> Server1 <----> lan1 (192.168.1.0/24)
<--------------->
ipip0(172.18.0.0/30)(remote/local = wireguard tunnel
endpoints)
172.18.0.2/30 172.18.0.1/30
Servers specs:
Server1/2 Ubuntu 16.04.02 (Kernel 4.4.0-78-generic)
WG version: 0.0.20170517-wg2~xenial
Best regards.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: TCP traffic in ipip tunnel inside wireguard connection
2017-05-29 20:57 TCP traffic in ipip tunnel inside wireguard connection Ivan Leonardo
@ 2017-05-29 21:02 ` Jason A. Donenfeld
2017-06-06 20:49 ` Jörg Thalheim
1 sibling, 0 replies; 3+ messages in thread
From: Jason A. Donenfeld @ 2017-05-29 21:02 UTC (permalink / raw)
To: Ivan Leonardo; +Cc: WireGuard mailing list
Hi Ivan,
I'll try to reproduce in order to determine whether or not there's a
checksum bug with nested tunnels. However, all of this seems quite
unnecessary:
Just set allowed-ips to be your /30 for each peer. If you need one to
be 0.0.0.0/0 at one time or another, you can change these at runtime.
Alternatively, if you _must_ have multiple 0.0.0.0/0 just use two
different wireguard interfaces running on different UDP ports, and
then you'll have the full power of the ordinary linux routing table
for this sort of craziness.
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: TCP traffic in ipip tunnel inside wireguard connection
2017-05-29 20:57 TCP traffic in ipip tunnel inside wireguard connection Ivan Leonardo
2017-05-29 21:02 ` Jason A. Donenfeld
@ 2017-06-06 20:49 ` Jörg Thalheim
1 sibling, 0 replies; 3+ messages in thread
From: Jörg Thalheim @ 2017-06-06 20:49 UTC (permalink / raw)
To: wireguard
Like Jason said, multiple wireguard interfaces are the way to go here.
You can then set up your routing protocols on top.
On 2017-05-29 21:57, Ivan Leonardo wrote:
> Hello
>
> Recently i have been experimenting with wireguard, and in fact the performance in wg is better than the ipsec tunnels i have. In my ipsec implementation i'm using vti interfaces(SAs 0.0.0.0/0) and i can select the traffic flow with static/dynamic routing.
>
> Knowing that wg doesn't allow multiple tunnels with allowedip=0.0.0.0/0, i tried to create a ipip tunnel using the wg endpoint tunnel ips. I don't have problems with UDP/ICMP traffic, but with TCP when a host(192.168.1.110) in lan1 tries to communicate with the ip of the ipip tunnel in server2, the returning tcp traffic has bad tcp checksum and the packets are discarded. If i try to send tcp packets with the source ip of the ipip tunnel of server2 to host(192.168.1.110) in lan1 , in tcpdump in server2 i see the tcp packets, but in the tcpdump in server1 i dont see the packets.
>
> Resuming, in this topology i only have problems with tcp traffic, udp and icmp works fine.
>
>
> I have search the web for this use case, but didn't find anyone using it, in this topic https://forum.freifunk.net/t/wireguard-0-0-20161230-linuxkernel-3-18-gluon-v2016-2-2/14122 , they managed to get a gre/gretap tunnel functioning with wg.
>
> Does anyone have any ideia if its possible to use this topology?
>
> Topology:
>
> 172.16.17.2/30 172.16.17.1/30
> wg0(172.16.17.0/30)
> Server2 <----------------------> Server1 <----> lan1 (192.168.1.0/24)
> <--------------->
> ipip0(172.18.0.0/30)(remote/local = wireguard tunnel endpoints)
> 172.18.0.2/30 172.18.0.1/30
>
> Servers specs:
>
> Server1/2 Ubuntu 16.04.02 (Kernel 4.4.0-78-generic)
> WG version: 0.0.20170517-wg2~xenial
>
>
> Best regards.
>
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-06-06 20:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-29 20:57 TCP traffic in ipip tunnel inside wireguard connection Ivan Leonardo
2017-05-29 21:02 ` Jason A. Donenfeld
2017-06-06 20:49 ` Jörg Thalheim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).